Privacy Policy

The legal name of the Obrokio operator, registered address, registration number and tax ID must be verified and inserted here before production release.

Privacy questions and rights requests may be sent to kontakt@obrokio.rs. A verified privacy-controller contact must be confirmed before production release.

Account and contact data may include name, business email, phone, role, organisation and authentication status. Organisation data may include legal name, address, tax and registration identifiers, locations and departments.

Service data includes menus, meal choices, order status and history, deadlines, reports, invoice summaries, support correspondence and security logs. Do not enter health information or other sensitive personal data in free-text fields.

We process data to create and secure accounts, provide ordering and reporting, connect companies and caterers, communicate about the service, meet contractual and legal obligations, prevent abuse and support billing.

Depending on the relationship and applicable law, the basis may be performance of a contract, steps requested before a contract, legal obligation, legitimate interests in operating and securing a B2B service, or consent for optional analytics. The final basis mapping requires legal approval.

Data comes from users, their company or caterer, platform administrators and service activity. A company may provide employee account details; it must inform employees and have authority to do so.

The controller/processor roles between the platform, companies and caterers must be confirmed in the relevant contracts and data-processing terms.

Access is limited to authorised personnel and the relevant company or caterer. Technical providers may support hosting, database/authentication, transactional email, monitoring and self-hosted analytics.

Current technical services include Vercel hosting, Supabase database/authentication, the configured transactional email provider, and self-hosted Umami when analytics consent is granted. A verified processor list and agreements must be maintained before production release.

Provider hosting regions and any transfers outside Serbia or the EEA must be recorded. Where required, transfers will use an applicable legal mechanism and safeguards. Exact regions and safeguards must be verified before production release.

Account and service data is kept only as long as needed for the service, contracts, security, disputes and legal duties. Billing and tax records follow mandatory retention periods. Backup deletion may follow a controlled rotation period.

Consent preferences expire after 180 days and then a new choice is requested. Exact retention periods for each data category, backups, logs and Umami analytics require approval and operational documentation.

Subject to applicable law, individuals may request access, correction, deletion, restriction, portability or object to processing, and may withdraw consent at any time without affecting earlier lawful processing.

Requests may be sent to the contact above. Individuals may also complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection or another competent authority.

We use role and organisation access controls, encrypted transport, authentication, database policies, backups and operational monitoring appropriate to the service. No internet service can guarantee absolute security; suspected incidents should be reported promptly.

Necessary cookies or browser storage support authentication, security, language, interface state and the saved privacy choice. These are needed for requested service functions.

Optional anonymous analytics uses self-hosted Umami only after acceptance. It records normalized pages and approved events without account identifiers, free text, query strings, hashes or prices. We do not use advertising trackers or analytics user profiles. Preferences can be reopened and analytics withdrawn at any time.

The service is for business organisations and authorised workplace users. It is not directed to children.

We will update the version and effective date and provide appropriate notice when this policy changes materially.